Is CVE-2025-13462 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13462 being exploited in the wild.

How severe is CVE-2025-13462?

Informational severity, with a CVSS score of 2, published 12 March 2026.

Which products and versions are affected?

Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14.

Is there a fix for CVE-2025-13462?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-13462 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-13462?

Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13462: Python CPython tarfile misinterpretation via GNU long name normalization

CVE-2025-13462 · Severity: info · CVSS 2 · Published 2026-03-12

A vulnerability in Python's standard library for handling compressed archives could allow a specially crafted file to be misinterpreted. This issue occurs when processing files with very long names, causing the library to incorrectly identify a regular file as a directory. This can lead to data corruption during file extraction or cause software to stop reading the archive prematurely, potentially impacting the reliability of automated deployment tools and package managers.

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Quick answers

Is CVE-2025-13462 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13462 being exploited in the wild.
How severe is CVE-2025-13462?: Informational severity, with a CVSS score of 2, published 12 March 2026.
Which products and versions are affected?: Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14.
Is there a fix for CVE-2025-13462?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13462 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-13462?: Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The 'tarfile' module in CPython contains a logic error in its header parsing routine. When processing multi-block members such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK, the module incorrectly applies normalization of AREGTYPE (\x00) blocks to DIRTYPE based on 'garbage' data in the secondary header. This root cause is located in the frombuf() function, which overrides the entry type to a directory. Consequently, the file offset is not updated correctly, often causing the parser to silently discard subsequent entries or fail with an exception. This can be exploited via a crafted tar archive to cause a denial of service (incomplete extraction) or bypass security checks that rely on accurate file type identification. Patches have been merged into CPython branches 3.10 through 3.14.

Affected products

Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14

Timeline

2025-11-18: disclosed: Issue first reported on GitHub
2026-03-12: advisory: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.